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DEVICE FOR MONITORING THE INTEGRITY OF INFORMATION 
DELIVERED BY A HYBRID INS/GNSS SYSTEM 

The invention relates to the monitoring of the integrity of position 
5 and speed information obtained from a hybridization between an inertial unit 
and a satellite positioning receiver. It more specifically relates to a navigation 
device known in the art by the name of INS/GNSS (standing for "Inertial 
Navigation System" and "Global Navigation Satellite System") that is 
hybridized in closed loop mode, the hybridization being said to be loose 

10 because it is implemented on geographic lines. 

An inertial unit is made up of a set of inertial sensors (gyrometric 
sensors and accelerometric sensors) associated with electronic processing 
circuitry. A computation platform, called virtual platform PFV, then delivers 
the speed and position information of the bearer in a precise frame of 

15 reference (denoted LGT, or local geographic trihedron). The virtual platform 
PFV is used to project and integrate the data obtained from the inertial 
sensors. The inertial unit supplies information that is accurate in the short 
term but tends to drift in the long term (under the influence of sensor defects). 
Control of the sensor defects represents a very high proportion of the cost of 

20 the inertial unit. 

A satellite positioning receiver supplies position and speed 
information concerning the bearer by triangulation based on the positions of 
orbiting satellites visible to the bearer. The information supplied can be 
temporarily unavailable because the receiver needs to have in direct view a 

25 minimum of four satellites of the positioning system to be able to establish a 
point. It is also of variable accuracy, dependent on the geometry of the 
constellation on which the triangulation is based, and affected by noise 
because of the reliance on the reception of very weak signals originating from 
distant satellites having a low transmit power. However, they are not subject 

30 to drift in the long term, the positions of the orbiting satellites being known 
accurately in the long term. The noises and errors can be linked to the 
satellite systems, to the receiver or to the propagation of the signal between 
the satellite transmitter and the GNSS signal receiver. Furthermore, the 
satellite data may be erroneous as a consequence of failures affecting the 

35 satellites. This non-integrated data must then be identified to prevent it from 
falsifying the position obtained from the GNSS receiver. 
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To anticipate the satellite failures and ensure the integrity of the 
GNSS measurements, a known method is to equip a satellite positioning 
receiver with a so-called RAIM (Receiver Autonomous Integrity Monitoring) 
system (an accuracy and availability estimation system) which is based on 
5 the geometry of the satellite constellation used in the triangulation and on the 
predictable short-term trend of this geometry deduced from the knowledge of 
the trajectories of the satellites. However, this system, purely linked to the 
satellite location system, is not applicable to the monitoring of a location point 
derived from a hybrid system (INS/GNSS) and can detect only certain types 

10 of failures in a given time. 

The hybridization consists in mathematically combining the 
position and speed information supplied by the inertial unit and the satellite 
positioning receiver to obtain position and speed information by exploiting 
both systems. Thus, the accuracy of the positioning information supplied by 

15 the GNSS system can be used to control the inertial drift and the inertial 
measurements that are little affected by noise can be used to filter the noise 
on the measurements of the GNSS receiver. This combination very often 
makes use of the Kalman filtering technique. 

Kalman filtering is based on the possibilities of modeling the trend 

20 (or evolution) of the state of a physical system considered in its environment, 
by means of a so-called "evolution" equation (a priori estimation), and of 
modeling the dependency relationship existing between the states of the 
physical system concerned and the measurements by which it is perceived 
from outside, by means of a so-called "observation" equation to allow for a 

25 reset of the states of the filter (a posteriori estimation). In a Kalman filter, the 
actual measurement or "measurement vector" is used to produce an a 
posteriori estimate of the state of the system which is optimal in the sense 
that it minimizes the covariance of the error made on this estimation. The 
estimator part of the filter generates a priori estimates of the state vector of 

30 the system using the deviation observed between the actual measurement 
vector and its a priori prediction to generate a corrective term, called 
innovation. This innovation Is applied to the a posteriori estimate of the state 
vector of the system and results in the optimal a posteriori estimate being 
obtained. 
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In the case of a hybrid INS/GNSS system, the Kalman filter 
receives the position and speed points supplied by the inertia! unit and the 
satellite positioning receiver, models the trend of the errors of the inertial unit 
and delivers the a posteriori estimate of these errors which is used to correct 

5 the positioning and speed point of the inertial unit. 

The estimation of the position and speed errors due to the defects 
of the inertial sensors appearing at the output of the virtual platform PFV of 
the inertial unit is produced by the Kalman filter. The correction of the errors 
through the intermediary of their estimation done by the Kalman filter can 

10 then be done at the input of the virtual platform PFV (closed loop 
architecture) or at the output (open loop architecture). 

When the defects of the sensors of the inertial unit are not too 
great, there is no need to apply the corrections at the input of the virtual 
platform PFV. The modeling of the system (linearization of the equations 

15 governing the evolution of the system) within the filter remains valid. The a 
posteriori estimate of the errors of the inertial unit calculated in the Kalman 
filter is used only to create the best estimate of the position and speed of the 
bearer given the position and speed information supplied by the inertial unit 
and by the GNSS receiver. The hybridization is then said to be "open loop". 

20 When the inertial defects are too great, the linearization of the 

equations governing the evolution of the inertial model integrated within the 
Kalman filter is no longer valid. It is therefore essential to apply the 
corrections to the virtual platform PFV to remain within the linear domain. The 
a posteriori estimate of the errors the inertial unit calculated in the Kalman 

25 filter is used not only to create the best estimate of the position and speed of 
the bearer, but also to reset the inertial unit within the virtual platform PFV. 
The hybridization is then said to be "closed loop". 

The hybridization can also be done by observing GNSS 
information of different types. Either, the position and speed of the bearer 

30 resolved by the GNSS receiver can be considered, in which case the 
hybridization is said to be "loose", or the information extracted upstream by 
the GNSS receiver - the pseudo-distances and pseudo-speeds (quantities 
directly derived from the measurement of the propagation time and from the 
Doppler effect of the signals sent by the satellites to the receiver) - can be 

35 considered, in which case the hybridization is said to be "tight". 
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With a closed loop INS/GNSS system in which the point resolved 
by the GNSS receiver is used to reset the information originating from the 
inertial unit, it is necessary to pay particular attention to the defects affecting 
the information supplied by the satellites, because the receiver that receives 
5 the information will propagate these defects to the inertial unit, resulting in an 
incorrect reset of the latter. The problem becomes particularly critical when it 
comes to ensuring the integrity of a hybrid INS/GPS point. 

A known way of proceeding to monitor the integrity of an 
INS/GNSS hybrid system in closed loop mode is disclosed in US patent 
10 5,583,774. It consists in spacing the resets by a time that is long enough (for 
example 30 minutes) for a Kalman-filter-based detector monitoring the trend 
of the pseudo-distance and pseudo-speed measurement deviations, relative 
to the bearer of each visible satellite, to be able to isolate the malfunctioning 
satellites. 

15 Another known method for monitoring the Integrity of an 

INS/GNSS hybrid system is disclosed in US patent 5,923,286. It involves the 
use of an RAIM device to enable or disable the hybridization. When the RAIM 
device signals a loss of integrity, the hybridization is frozen and the position 
and speed point is supplied by the INS unit taking into account its drifts and 

20 bias measured just before the loss of integrity. For this to work, it is essential 
for the inertial unit not to have been corrupted by the point error committed by 
the GNSS receiver, which prohibits that being reset with the GNSS receiver. 
The method is therefore reserved only for the open loop INS/GNSS hybrid 
systems. 

25 The object of the present invention is to monitor the integrity of the 

position and speed information of a hybrid system comprising an inertial unit 
reset with the help of a GNSS receiver by using the resolved position and 
speed of the bearer obtained from the GNSS receiver. 

Its subject is a device for monitoring the integrity of a hybrid 

30 system comprising an inertial unit INS, a GNSS satellite positioning receiver 
operating on the basis of a constellation of N visible satellites and a Kalman 
hybridization filter having a state vector corresponding to the errors of the 
hybrid system, in particular, the bias and residual drift errors of the inertial 
unit INS, observing the deviations between the positioning and speed points 

35 supplied, in the form of geographic coordinates, by the inertial unit INS and 
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by the GNSS receiver, having an evolution matrix F modeling the trend of the 
errors of the hybrid system, an observation matrix H modeling the 
relationships between the state vector and the deviations observed between 
the positions and the speeds delivered by the inertia! unit INS and the GNSS 

5 receiver, and a gain K minimizing the covariance of the error made on the a 
posteriori estimation of the position and speed errors derived from the inertial 
unit, and delivering an a posteriori estimate of the errors of the hybrid system 
used to reset the inertial unit. This monitoring system is noteworthy in that the 
GNSS receiver delivers, in addition to a position point established from the N 

10 satellites of the constellation that is has in view, N-1 position points 
established from the constellation of the N visible satellites deprived, each 
time, of a different satellite and in that it comprises a satellite problem- 
detector circuit comprising a bank of N predictor/estimator filters of the error 
induced by the satellite that was removed on resolving a point with N-1 

15 satellites, having the gain K and the evolution matrix F of the Kalman 
hybridization filter, each filter observing the deviation between the position 
point, in the form of geographic coordinates, delivered by the GNSS receiver 
by observing the N visible satellites and one of the position points, also in the 
form of geographic coordinates, delivered by the GNSS receiver by 

20 observing N-1 visible satellites and test circuits comparing the states of the N 
predictor/estimator filters with their variances and detecting a satellite failure 
when the test is positive, the deviation found being greater than a detection 
threshold. 

25 Advantageously, the test circuits have satellite-failure detection 

thresholds that result from statistical tests taking account of the covariance 
associated with the type of positioning error concerned. 

Advantageously, the test circuits have satellite-failure detection 
30 thresholds that result from statistical tests taking account of the covariance 
associated with the type of positioning error concerned and that are a 
function of the acceptable false alarm ratio for the test. 

Advantageously, the monitoring system comprises a reset 
35 inhibition circuit inserted between the output of the Kalman hybridization filter 
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and a reset input of the inertial unit, and activated by a positive satellite 
problem-detection test. 

Advantageously, the predictor/estimator filters of the satellite 
5 problem-detector circuit (first filter bank) all have the same observation 
matrix. 

Advantageously, the GNSS receiver also delivers position points, 
in the form of geographic coordinates, established from the N visible 

10 satellites and those established from N-1 satellites deducted from the 
constellation formed by the N visible satellites by each time removing a 
different visible satellite, Nx(N-1)/2 position points with N-2 satellites 
deducted from the N visible satellites by each time removing two different 
visible satellites, and the monitoring system comprises a malfunctioning- 

15 satellite identification circuit comprising a second bank of Nx(N-1)/2 
positioning deviation predictor/estimator filters having the gain K and the 
evolution matrix F of the Kalman hybridization filter, each filter observing the 
deviation between a position point, in the form of geographic coordinates, 
delivered by the GNSS receiver from N-1 satellites out of the N visible 

20 satellites and one of the positioning points delivered by the satellite 
positioning receiver from N-2 satellites out of the N visible satellites deducted 
from the specific constellation of (N-1 ) visible satellites deprived of one of its 
visible satellites, the estimator-detector filters being able to be grouped in 
families of N-2 elements according to the specific constellation of N-1 visible 

25 satellites taken into account, test circuits comparing the states of the 
Nx(N-1)/2 predictor/estimator filters with their variances in order to detect any 
anomaly and a processing circuit identifying, if anomalies are detected, a 
faulty satellite as being the satellite excluded from a point with n-1 satellites 
for which the family of predictor/estimator filters is the only one not to have 

30 any of its elements detecting an anomaly. 

Advantageously, the predictor/estimator filters of the 
malfunctioning-satellite identification circuit all have the same observation 
matrix. 

35 
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Advantageously, the predictor/estimator filters of the satellite 
problem-detector and of the malfunctioning-satellite identification circuit all 
have the same observation matrix. 

5 

Other characteristics and advantages of the invention vAW become 
apparent from the description that follows of an embodiment given by way of 
example. This description is given in light of the drawing in which: 

- figures 1 and 2 represent a theoretical diagram of a closed loop, 
10 loose type hybrid INS/GNSS positioning system, figure 1 

detailing the inertial unit and figure 2 the Kalman filter, 

- figure 3 represents a hybrid INS/GNSS positioning system 

provided with a satellite problem-detector circuit compliant with 
the invention, 

15 - figure 4 represents a hybrid INS/GNSS positioning system 

provided with a satellite problem-detector circuit and a faulty- 
satellite identification circuit compliant with the invention, and 

- figure 5 details the constitution of the faulty-satellite identification 

circuit of figure 4. 

20 

Figure 1 shows the architecture of a hybrid positioning system 
equipped with an inertial unit 1 and a GNSS satellite positioning receiver 2, 
said to be in closed loop mode and of loose type, because it uses resolved 
position (latitude, longitude and altitude) and speed (speed north, speed east 

25 and speed vertical) information concerning the bearer delivered by the GNSS 
receiver 2 for resetting of the inertial unit INS 1 . 

As shown, the inertial unit comprises a set 10 of inertial sensors 
(accelerometers and gyrometers) and computation circuits, called virtual 
platform PFV, to perform the position, attitude and speed computations on 

30 the outputs of the Inertial sensors. The virtual platform PFV mainly comprises 
a set of integrators 1 1 operating on the signals Q of the gyrometers in order 
to deduce from them the attitude of the bearer, a fix changer 12 used, based 
on the knowledge of the orientation of the bearer (attitude), to express within 
a geographic fix linked to the Earth, the accelerations acc measured by the 

35 accelerometers within a fix linked to the bearer and two successive integrator 



sets 13, 14 operating on the components of the acceleration according to the 
geographic fix, to deduce from them the components of the speed of the 
bearer relative to the north Vn, relative to the east Ve and relative to the 
vertical Vv as well as the position of the bearer in latitude, longitude and 
5 altitude. The inertial sensors are subject to defects inherent in their design: 
biases and drifts that make the position and attitude information delivered by 
an Inertial unit degrade over operating time. Trying to overcome these 
defects is costly, so there are various classes of Inertial unit according to 
accepted bias and drift tolerances. 

10 The GNSS receiver 2 is, for example, a GPS receiver. It measures 

the pseudo-distances and pseudo-speeds of the bearer relative to at least 
four satellites visible to the bearer of the hybrid positioning system and 
resolves, by triangulation, the position of the bearer in latitude, longitude and 
altitude, as well as the components of its speed relative to the north Vn, 

15 relative to the east Ve and relative to the vertical Vv. It will not be described 
In more detail because it is well known to those skilled In the art and widely 
described in the literature in which numerous works are devoted to it, such 
as, for example the book by Elliot D. KAPLAN entitled "Understanding GPS 
Principles and Applications", published by Artech House Publishers, ISBN 0- 

20 89006-793-7. The position and speed information delivered by a GNSS 
receiver is not subject to drift since it originates from instantaneous 
measurements of separation distances and speeds of separation of satellites 
for which the orbits and the positions in their orbits are known in the long 
term. However, It is subject to unavailability, when there are not at least four 

25 satellites visible. It is affected by noise because it originates from the 
processing of received signals that are very weak because of the distance 
separating the satellites and their weak transmit powers and that may have 
been corrupted during transmission (encountering charged particles between 
the satellite and the receiver). The reliability of the information depends on 

30 that of the information transmitted by the satellites. 

Compared to the GNSS receiver, the inertial unit has the 
advantage of not requiring the collaboration of equipment external to the 
bearer and therefore of not being so sensitive to the external environment. 
Since the integrity and availability of the inertial information is much better, 

35 the inertial unit retains all its interest. To fight against its drift and bias other 
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than by costly measurements taken on its inertial sensors, a periodic reset is 
proposed by means of the position and speed point supplied by a GNSS 
receiver, after an anti-noise filtering. 

This reset is done using a so-called Kalman hybridization filter 3 
5 shown in greater detail in figure 2. 

A Kalman filter is used to obtain an estimation of the a posteriori 
state of a system, optimal in the sense that the covariance of the error made 
on this a posteriori estimation is minimal (also referred to as optimal 
estimation in the least squares sense). It is based on a modeling of the 
10 evolution of the system and on a modeling of the relationship existing 
between the measurement and the state of the system. 

In its most general meaning, the modeling of the evolution of the 
state of the system is defined by a first order, linearized vectorial differential 
equation which is expressed, after discretization of the continuous model, by 
15 an evolution equation which takes the form: 

X being the dimension state vector p, u a control vector, Fk the evolution 
matrix defining the relationship between the state vector in the step K and the 
state vector in the step K+1 in the absence of control vector and operating 
20 noise. Lk being a matrix defining the relationship between the control vector 
and the state vector during one and the same step and wk being an operating 
noise during a step, assumed to be white and Gaussian of zero average 
value. 

The modeling of the relationship existing between the 
25 measurement and the state of the system is defined by another first order 
differential equation that expresses, after discretization of the continuous 
model, by an observation equation that takes the form: 

z being the dimension measurement vector m (physically observable 
30 system quantities), Hk being the observation matrix defining the relationship 
between the measurement vector and the state vector during one and the 
same step and vk being a measurement noise during a step assumed to be 
white and Gaussian of zero average value. 

The Kalman filter shown in figure 2 does not include a control 
35 vector and therefore has no matrix Lk. It is recursive and relies on the 
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determination of an a priori estimation x^^^j^^^ of the state vector of the system 
in the step K from the a posteriori knoNA/ledge of the state vector of the system 
^K-vK-i t^^® preceding step K-1 and on the application to the a priori 
estimate of a correcting term dependent on the deviation observed 

5 between the measurement vector observed during this step K and its a 
priori estimate f deducted from the a priori estimation Jcj^/^_, of the state 
vector. 

The a priori estimate z^^/j^., of the measurement vector in the step 
K is determined by application of evolution and observation equations to the 
10 a posteriori estimate Xf._y^_^ of the state vector corresponding to the 
preceding step K-1 . This operation is illustrated in figure 2 by the presence of 
a retroaction loop comprising a delay circuit 30 and two filters 31, 32. 

The delay circuit 30 connected to the output of the Kalman filter is 
used to store the a posteriori estimate of the state vector available at 

15 the output of the Kalman filter during the preceding step K-1 . 

The filter 31 is used, by implementing the evolution equation, to 
obtain the a priori estimate of the state vector in the step K, from the a 

posteriori estimate Jc^_,/^.i of the state vector of the system in the preceding 
step K-1 . Its transfer function is defined by the matrix Fj^_i of the evolution 
20 equation. 

This a priori estimate Xf.^^_^ of the state vector in the step K is then 
used to obtain, by means of a second filter 32, the a priori estimate of 
the measurement vector in the step K by application of the observation 
equation. To do this, this second filter 32 has a transfer function defined by 

25 the matrix //^^ of the observation equation. 

The a priori estimate z^.^^^^ of the measurement vector in the step 
K obtained in the retroaction loop is applied, as input to the Kalman filter, to a 
subtracter circuit 33 which also receives the measurement vector z^. actually 
measured during the step K and which delivers an error vector , also called 

30 innovation, attesting to the error committed in the a priori estimation. This 
error vector r^^ is transformed by a third filter 34 into a correction vector. This 
correction vector is added by a second summer 35 to the a priori estimate 
^K/K-i of the state vector for the step K derived from the first filter 31 , to 
obtain the a posteriori estimate x^^j^ of the state vector that constitutes the 

35 output of the Kalman filter. 
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The third filter 34, which supplies the corrective term, is known as 
a reset gain filter. It has a transfer function defined by a matrix a:^ 
determined so as to minimize the covariance of the error made on the a 
posteriori estimation. 
5 Kalman showed that the optimal gain matrix AT^ could be 

determined by a recursive method from the equations: 

-of the covariance matrix of the a priori estimate of the state 

vector 

^KfK-\ ~ ^K-\^K-\t K-\^K-\ Qk-\ 

10 - for defining the gain matrix itself 

- for updating the covariance matrix of the a posteriori estimate of 
the state vector 

15 P being the covariance matrix of the state vector, either estimated a priori for 
the step K from the step K-1 if P is assigned the index K/K-1 , or estimated a 
posteriori if P is assigned the index K-1/K-1, 
R being the covariance matrix of the observation noises w^r , 
Q being the covariance matrix of the state noises (or operating noises) . 

20 On initialization, the covariance matrix of the state vector and the 

state vector are taken to be equal to their most probable estimates. At worst, 
the covariance matrix is a diagonal matrix with infinite or extremely large 
terms (so as to have very great standard deviations given the field in which 
the state vector is likely to evolve) and the estimate of the state vector is the 

25 zero vector, when the initial values are absolutely unknown. 

In practice, the correction gain of a Kalman filter is "proportional" 
to the uncertainty on the a priori estimate of the state of the system and 
"inversely proportional" to the uncertainty on the measurement. If the 
measurement is highly uncertain and the estimation of the state of the 

30 system is relatively accurate, the observed deviation is mainly due to the 
measurement noise and the consequential correction must be small. On the 
other hand, if the uncertainty on the measurement is low and that on the 
estimation of the state of the system is high, the observed deviation is highly 
representative of the estimation error and should result in a big correction. 

35 This is the behavior towards which there is a tendency with the Kalman filter. 
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In summary, a Kalman filter with no control vector is defined by a 
matrix Fk corresponding to the evolution equation defining the evolution of 
the state vector of the physical system being modeled, a matrix Hk 
corresponding to the observation equation defining the relationships used to 
5 pass from the state vector to the measurement vector and a gain matrix Kk 
updated using an iterative process involving the covariance matrix of the 
state vector P, itself updated during the iterative process, and the covariance 
matrices Qk and Rk of the state and measurement noises. 

The Kalman filter 3 operates on the deviations observed between 

10 two versions of information of the same type, one originating from the inertial 
unit INS 1 and the other from the GNSS receiver 2, because this makes it 
possible to work on variables having more restricted variation ranges on 
which the linear approximation can be used to simplify the modeling and 
evolution equations (the term "error filter" is then used). 

15 In this context, the evolution equation of the Kalman filter models 

the predictable trend of the errors on the hybrid system linked to the residual 
values of the inertial sensor defects not estimated and to the mechanization 
of the inertial platform (in this case closed loop) of the inertial unit 1 that it 
deduces from the differences observed between the deviation forecast that it 

20 makes and the deviations actually measured between the position and the 
speed derived from the inertial unit and from the GNSS receiver. It is 
determined by the matrix F, the definition of which is a function of the motion 
of the bearer, that is, of the flight parameters in the case where the bearer 
equipped with the hybrid positioning system is an aircraft. The definition of 

25 the different versions of this matrix F as a function of the motion parameters 
of the bearer falls outside the scope of the present invention. It will not be 
detailed below because it is well known to those skilled in the art specializing 
in the field of inertia. 

The residual values Xj^^^ of the errors of the hybrid system 

30 estimated a posteriori by the Kalman hybridization filter 3 are used to reset 
the INS inertial unit 1 (dosed loop). Since the INS 1 inertial information is 
regularly reset, the hybrid position and speed points are assumed more 
reliable provided that the GNSS measurements are integrated. 

To sum up, the processing carried out by the Kalman hybridization 

35 filter is divided into three stages: 
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Propagation of the state vector and of the associated variance- 
covariance matrix 

^K+\fK ^^K+V^KIK ^COR_FK _Pf. 

P —FP F^ +0 

5 - Resetting of the state vector and of the variance-covariance matrix 
using the gain Kk^i 

^K+l ~ ^K+l I K K+\ KM -^K+X / K K+l ^/T+l ) 

-^K+l/K+l ^^K+\iK "^^K+X-^K+l ~ ^K+l"^K+l/K^ 
^K+l/K+l ~^K+l/K ~ ^K+l-^K+l'^K+l/K 

10 - Application of the corrections derived from the Kalman 

hybridization filter to the inertia! unit 

COR_FK^p^ =-X^,^ 

The observation matrix Hk+i is used to observe the differences 
between the positions and speeds derived from the virtual platform PFV and 

15 the resolved GNSS positions and speeds. The evolution matrix Fk+i is 
computed using the data from the virtual platfonn PFV corrected by the 
Kalman filter and is used to propagate the state and the associated variance- 
covariance matrix. 

The problem encountered with the closed loop INS/GNSS hybrid 

20 positioning systems is the risk of seeing the reset operations propagate to the 
inertial unit 1 the position and speed errors committed by the GNSS receiver 
2 because of defective information reaching it from one or more 
malfunctioning satellites (poor corrections applied by the Kalman filter to the 
virtual platform PFV, poor estimation of inertial defects). The integrity of the 

25 closed loop INS/GNSS hybrid positioning system is then difficult to ensure. 

Figure 3 is the diagram of a closed loop INS/GNSS hybrid system 
equipped with a satellite problem-detector operating on position points, in the 
form of geographic coordinates, performed by the GNSS receiver 2 with all 
the visible satellites assumed to number N and with all the visible satellites 

30 minus one of them, the visible satellite that is set aside being any one of 
them. 

The satellite problem-detector 4 comprises a bank of N 
predictor/estimator filters 40i, 402,..., 40i,...,40N associated with a bank of 
test circuits 41 1, 41 2, .., 41j,...,4lN controlling, via an inhibition circuit 5 
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inserted at the output of the Kalman hybridization filter 3, the possibility of 
reset of the inertial unit 1 . 

The predictor/estimator filters 40i. 402,..., 40i,..,,40N operate in 
open loop mode. 

The state vector of the i*^ predictor/estimator filter 40i is made up 
of the en-ors relative to the state vector of the Kalman hybridization filter 
induced by the fact that the information given by the i^^ visible satellite has not 
been taken into account in the GNSS receiver 2, and even more generally 
relative to measurements made by other navigation equipment such as a 
barometric altimeter or an anemometer. 



Err' = 



attitude _ errors _ relative _to _ FK 
speed _ errors _ relative _to FK 
position _ errors _ relative _to _ FK 
accelero _ bias _ errors _ relative _to_ FK 
gyro drift _ errors _ relative _to_ FK 
baro _ errors _ relative _to_ FK 
anemo errors relative to FK 
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The evolution matrices Fk of the various predictor/estimator filters 
40i, 4O2...., 40i,...,40N are identical to that Fk of the Kalman hybridization 
filter 3: 

E^^k^i/K - ^ic+i -^^^kiK ( 1 ) 

The measurement T of an i*^ predictor/estimator filter 40i is made 
up of the deviation between the position, in the form of geographic 
coordinates (latitude, longitude and altitude), resulting from the positioning 
point P^,^, established by the GNSS receiver 2 taking into account all the N 
visible satellites and the position, in the form of geographic coordinates, 
resulting from the positioning point established by the GNSS receiver 

2 by setting aside the information sent by the i^^ satellite: 



Z' = 



Az'* 



15 



The observation matrices H of the different predictor/estimator 
filters 40i, 4O2,..., 40j,...,40N are all identical and correspond to the 
observation equation used to pass from the state vector Err' to the 
measurement vector Z' . 
5 The gains of the different predictor/estimator filters 40i, 4O2,..., 

40i,...,40N are all taken to be equal to that K of the Kalman hybridization filter 
3 such that the reset on the measurements z' that they receive takes place 
like the reset of the Kalman hybridization filter 3. 

Given these choices, the resets of the state vectors Err* of the 
10 predictor/estimator filters 40i, 4O2. .. , 40j,... ,40n satisfy the relation: 

To detect the failure of at least one of the N visible satellites by the 
GNSS positioning receiver 2, statistical tests are run on the state vectors 
Err' available at the output of the different predictor/estimator filters 40i, 
15 4O2,..., 40i,.,,.40N by means of the bank of test circuits 41 1, 41 2,. ., 
41i,...,4lN- These test circuits run statistical tests consisting In admitting a 
satellite failure if, for i ranging from 1 to the number N of visible satellites, one 
of the following two inequalities on the position errors of the 
predictor/estimator filters 40i, 4O2,..., 40i....,40N is satisfied: 

20 

{err _ lat)* .Errj^^yf. {err _ lat)\ > K _ thresh * ,K _ thresh.COV _ Erri^^y^. {err _ lat) 

or 

[^^rrj^^., / f. {err _ Ion )* -Errj^^^ ^ ^ {err _ lon)\ > K _ thresh * -AT _ thresh,CO V _ Errl^^^ ^ {err _ Ion ) 



25 The variable K_thresh indirectly controls the value of the 

acceptable radial error. It is chosen as a function of the required false alarm 
ratio. For a false alarm probability of 10"®, a value of approximately 5.06 
(Gaussian distribution) will be taken for the variable K_thresh. 

To carry out these statistical tests, it is essential to be able to 
30 propagate and reset the variances associated with the state vectors ErH of 
the different predictor/estimator filters 40i, 4O2,..., 40i,...,40N. The 
propagation and reset can be carried out as follows: 
On initialization, the following is assumed: 
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COV_Err^,o=[o] 
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[o] being the zero matrix. 

On first propagation, by definition: 

COV_Err;,, =^ E[Err;,,.Err;J \ 

5 

which, because of the relation (1), is expressed: 

COV_Err;,,=ElF,.Erri,,^u,'](F,^^^^^ ^u,J\ 

10 being a white noise (state noise). 
Hence: 

COV^Err;,, ^ F,.COV _Erri,^.F,^ +0, 

F being the evolution matrix of the Kalman hybridization filter 3 and Qi the 
15 covariance matrix of the state noises of the Kalman hybridization filter 3. 
On first reset, by definition: 

COV_Err;„ ^ E^rr;,,.Errlj\ 
20 which, taking into account the relation (2), is expressed: 

By developing this expression, we find: 

25 

COV_Erri„ = ^[err/^o .Erri,j\¥ K,.E^, ,Z''' \k,^ -\- K,.H,,E\Errl,^ .Errlj\H,^.Ki'... 
Hence: 

30 

COV_Errl, ={l - K,,H,\COV _Err;,^{l - K,.hJ + K,.E^' -Z'^l^x^ 



I being the identity matrix. 
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The first term of the expression of the reset of the covariance 
matrix is computed from the observation matrix Hi of the predictor/estimator 
filters 40i, 402,.... 40i,...,40N and the gain matrix Ki of the Kalman 
hybridization filter 3. The second term is computed using the 
variance/covariance matrices used in the least squares computations 
performed for position, speed and time resolution in the GNSS receiver 2, on 
positioning points with N and (N-1) satellites. In practice, on this resolution, 
the least squares method estimates the degree of reliance on the points 
resolved by means of the variance/covariance matrices (matrices 
E[P(n-ivi.P(n-i)/] for the N points with (N-1) satellites and E[Ptot.Pto/] for the 
point with N satellites). 

Now: 

Because: 



r = 



Ay 

Az' 



By developing the first expression, we obtain: 



20 The first two terms are known. They are directly supplied by the 

least squares computations on resolution of the different position, speed and 
time points done by the GNSS receiver 2. 

The terms E[p^^_,y,,Pl] and ^k,.P(L.)//J. reflecting the 
intercorrelation between the positioning point Ptot with N satellites and the 
25 positioning points P(n-i)/i with (N-1) satellites, can be evaluated by repeating 
the least squares expression of each point. 
In practice, we have: 

^{N'i)/i being the pseudo-inverse matrix used in the position, speed and time 

30 resolution done on the positioning point established with N-1 satellites 
(absence of the i*^ satellite): 
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H(N-x)n^{H(N-x)irH(^-x)^^^^^ being constructed from the matrix 

which is the matrix of the directing cosines linking the pseudo-distances d to 
the position resolved by the relation: d = ^(A^_i)/,.i(A^^i)/, 

d being the vector formed by the pseudo-distances. 
5 Thus: 



Now: 



10 and: 



'^Z - (N-\)li -^{N-xVi ) -^tot ^^Jot tot ) } 



tot) f - {^L '^tot ) * 

because the relation: 

ipL-^tot) {^L'^tot)=^ 

15 results in: 

{^L -^tot ) = L '^tot ) f 

Therefore: 

^(N-X)/i '^Z = iP (N-i)li '^{N-X)/i ) '^{N-X)/i '^tot {^L tot ) 

20 Furthermore, the following equality is obtained: 

^L'^{N-X)/i ~ ^{N-x)/i^{N-X)/i 



The matrix differs from the matrix H^^^ only by the i line 

which is zero in the case of the matrix and which includes the 

25 directing cosines of the line in view of the i*^ satellite In the case of the matrix 
H^^^. By calculating the product of matrices fiJ^t H(N-i)/i' t*^® terms of the i**^ 
column of the matrix H^^ are multiplied by the zero terms of the matrix 
^{N-)/i ' Thus, if the terms of the i*^ column of a matrix multiplied by the matrix 
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fi(N-)fi already zero (as in the case of the matrix Hlf^,^^. ), there is no 
change. This explains the above equality. Consequently: 

^ tot tot 

5 therefore: 

Finally, we have the relation: 

10 

which shows that the matrix can be evaluated from matrices 

derived from the computations of the different position, speed and time points 

performed by the GNSS receiver 2. 

The first reset and the first propagation do not therefore pose any 
15 problem. The evolution Fi and gain Ki matrices used are those of the 

Kalman hybridization filter 3 whereas the observation matrix H is common to 

all the predictor/estimator filters 40i, 402,..., 40i,...,40N. 

By recurrence, it is possible to show that the same applies for the 

subsequent resets and propagations. 
20 When at least one of the statistical tests is raised or positive, there 

is a suspicion that one of the visible satellites used by the GNSS receiver 2 to 

determine the position and speed of the bearer is malfunctioning. This 

overrun is used to trigger the inhibition circuit 5 inserted between the output 

of the Kalman hybridization filter 3 and the reset input of the inertial unit 1. 
25 the satellite providing erroneous data will be reintegrated only when all the 

statistical tests are no longer raised, with, where appropriate, an additional 

precautionary delay. 

It will be noted that it is also possible to estimate a protection 

radius on the hybrid position derived from the inertial unit 1 by using the 
30 maximum separation method. 

The satellite problem-detector circuit 4 cannot be used to identify 

the faulty satellite because the erroneous information originating from that 



• t 
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satellite is taken into account in the point with N visible satellites used as a 
reference. 

Bearing in mind that one of the visible satellites used by the GNSS 
receiver 2 is sending suspect information, it is advantageous to be able to 
5 identify it to have it set aside by the GNSS receiver 2. 

Figure 4 gives an exemplary diagram of a closed loop mode 
INS/GNSS hybrid system equipped with a satellite problem-detector and a 
malfunctioning-satellite identifier. 

As in the case of figure 3, there is an inertial unit INS 1, a GNSS 

10 receiver 2, a Kalman hybridization filter 3 operating on the residual values of 
the errors between the position, in the form of geographic coordinates, given 
by the inertial unit INS 1 and that, also in the form of geographic coordinates, 
given by the GNSS receiver 2 and providing reset information to the inertial 
unit INS 1, and a satellite problem-detector circuit 4 similar to that of figure 3 

15 controlling an inhibition circuit 5 inserted between the output of the Kalman 
hybridization filter 3 and a reset input of the inertial unit INS 1. 

In addition to these elements, there appears a malfunctioning- 
satellite identification circuit 6 operating from different position points, in the 
form of geographic coordinates, established by the GNSS receiver 2 with all 

20 the visible satellites minus one and with all the visible satellites minus two, 
the two visible satellites that are set aside being different each time. The 
malfunctioning-satellite identification circuit 6 operates in parallel with the 
satellite problem-detector circuit 4. It is activated by the circuit 4 if a satellite 
problem is detected. It identifies the malfunctioning satellite for the GNSS 

25 receiver 2 which then no longer takes it into account in establishing the 
position and speed point that is sent to the Kalman hybridization filter. Once 
the malfunctioning satellite has been set aside, the satellite identification 
circuit 6 reenables the inhibition circuit 5 and the virtual platform PDV of the 
inertial unit INS 1 is once again corrected. 

30 The malfunctioning-satellite identification circuit 6 is based on tests 

taking as references the different possible position points with N-1 satellites 
that are compared with position points with N-2 satellites derived from these 
points with N-1 . These tests consist in: 

evaluating, for each possible selection of N-1 satellites out of 

35 the N observable satellites, the position deviations, in the form 
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of geographic coordinates, observed between the position point 
established by the GNSS receiver 2 with the set of the N-1 
satellites of the selection and the different possible position 
points with N-2 satellites that the GNSS receiver 2 can establish 
5 by setting aside an additional satellite from the selection, 

submitting these deviations to a bank of predictor/estimator 
filters to evaluate the error induced jointly by two satellites, 
comparing the states of this second bank of predictor/estimator 
filters with the variances that are associated with them, 

10 - identifying the family of filters not raising their statistical test and 

deducing from this the malfunctioning satellite, 
indicating to the GNSS receiver the corrupted satellite to 
remove it from the set of visible satellites used to resolve the 
position (and speed) point with N satellites communicated to the 

15 Kalman filter, 

reenabling the corrections supplied by the Kalman filter to the 
inertial unit once the defective satellite has been removed from 
the point of the GNSS receiver and the filter has been 
reconfigured. 

20 In practice, it is only when the faulty satellite is removed from the 

selection of N-1 satellites and from the resulting selections of N-2 satellites 
that the statistical tests on the states of the predictor/estimator filters are not 
triggered (tests not raised). 

As shown in figure 5, the malfunctioning-satellite identification 

25 circuit 6 comprises a bank of N.(N-1)/2 predictor/estimator filters 61 ij 
(1<i<j<N, i and j denote the satellites not observed on resolving the point with 
N-2 supplied to the predictor/estimator filter) processing all the deviation 
possibilities between a position point, in the form of geographic coordinates, 
with N-1 visible satellites and a position point, also in the form of geographic 

30 coordinates, with N-2 visible satellites, the satellite excluded from the 
selection with N-1 satellites also being excluded from the selection with N-2 
satellites. A test circuit 62jj associated with each predictor/estimator filter 61 ij 
of the bank tests the states modeled in the predictor/estimator filter against 
their variances. A processing circuit 63 extracts from the tests supplied by the 

35 test circuits 62ij the identity of the faulty satellite. 
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Each of the predictor/estimator filters 61 jj of the filter bank 
dedicated to identification of the malfunctioning satellite has the same 
configuration as the predictor/estimator filters 40i of the bank of filters 
dedicated to the detection of malfunctioning of a satellite with the same gain 
5 K, evolution F and observation H matrices, and receives, as measurement, 
the deviation supplied by a subtracter circuit 60^ between the position, in the 
form of geographic coordinates (latitude, longitude and altitude), resulting 
from a positioning point P^;^.,)/, established by the GNSS satellite positioning 
receiver 2 taking into account the N visible satellites minus one, the i*^ and 

10 the position in the form of geographic coordinates resulting from a positioning 
point P(N~2)fij established by the GNSS satellite positioning receiver 2 by 
setting aside the information from the satellite already excluded, the i^^ and 
one other, the j^^. 

The computations of the associated variances necessary to the 

15 test circuits 62ij for comparing the states with their variances are exactly the 
same as those described for the test circuits 41 j associated with the 
predictor/estimator filters A0\ of the first bank and will not be described again 
here. Only the observation is different since in this case it is a matter of 
difference between points resolved with (N-1) visible satellites and points 

20 resolved with (N-2) visible satellites. 

The processing circuit 63 compares the tests of the N different 
families, in which the 1**^ satellite has been removed for resolution of the 
position point with N-1 and of the position points with N-2 satellites (1<i<N), 
then identifies the defective satellite from the fact that only the 

25 predictor/estimator filters of one family, that never taking into account the 
defective satellite, has no statistical test raised. In practice, besides the other 
families of predictor/estimator filters comparing the position points with N-1 
where the malfunctioning satellite is present with position points with N-2 
satellites have at least one statistical test raised. This processing circuit 63 

30 makes it possible to avoid the use of the corrupted satellite in resolving the 
GNSS point supplied to the hybrid system. 

To help with understanding, the functions performed in a device 
for monitoring the integrity of an INS/GNSS hybrid system have been 
illustrated in the form of separate blocks, but obviously they can be provided 



23 



by one and the same programmed logic computer, for example the flight 
control computer if the bearer of the hybrid positioning system is an aircraft. 



